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Dated: 19 August 2020 


Subject: Amendments to TCF v2.0 Policies and Technical Specifications to require disclosure 
of storage duration (Planet49 ruling) 


Dear TCF CMPs and Vendors, 


Please note that the TCF v2.0 Policies have been amended and Technical Specifications 
updated bring the TCF in-line and provide the tools to help the industry comply with 
jurisprudential developments. We encourage swift implementation of the new policy 
requirements, since they have been part of the regulatory landscape since 1st October 2019. 
More details below. 


TCF v2.0 Policy amendments 

The Transparency and Consent Framework (TCF) Steering Group have recently approved an 
amendment to the TCF v2.0 Policies. The amendment seeks to implement the requirement to 
disclose the duration of operation of cookies (or other information stored/accessed on a 
user's device), resulting from the Court of Justice of the European Union (CJEU) ruling in case 
C-673/17 (Planet49). The change includes a new Policy 16(2bis) and an amendment to 
Appendix B, Policy C(c)(i). These new / amended policies contain: 


1. A requirement for Vendors to disclose maximum cookie storage duration on the GVL 
and whether other means of storage/access is used; 

2. A requirement for CMPs to disclose each vendor's maximum cookie storage duration 
and whether other means of storage/access is used to the user on a secondary layer 
of the user interface; 

3. An option for Vendors to disclose more detailed and purpose-specific storage and 
access information where they wish to demonstrate detailed compliance with the 
requirements of the ruling; 

4. A requirement for CMPs to disclose the more detailed and purpose specific storage 
and access information for each vendor, where vendors make this information 
available. 

5. A prohibition for Vendors to refresh the maximum storage duration where the 
maximum storage duration indicated on the GVL is not indefinite and unless the 
Framework signals indicate that the user has renewed their consent. 


Please consult the relevant sections of the updated Policies text for further details. 


TCF v2.1 Technical specifications update 

With a view to implementing these policy changes, IAB Tech Lab's GDPR Technical Working 
Group has developed a related Device Storage & Access Disclosure feature. The specification 
provides vendors with a method to disclose the amount of time any vendor-specific 
information may be stored on a device with varying degrees of detail. This includes a 
required disclosure as an added section in the Global Vendor List (GVL), which is used by 
CMPs to display the information to users. 
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The GVL registration will be updated with the following fields that will enable CMPs to make 
the additional disclosures to the user: 

e cookieMaxAgeSeconds: this field is required. It represents the number, in seconds, of 
the longest potential duration for cookie storage on a device. The related technical 
specification implements policy points 1) and 2) above; 

e usesNonCookieAccess: this field is required. It indicates whether the vendor uses other 
methods of storage or accessing information already stored on a user's device (e.g. 
local storage). The related technical specification implements policy points 1) and 2) 
above; 

e deviceStorageDisclosureUrl: this field is optional. It contains an optional, vendor- 
supplied, secure URL for disclosing additional storage information through a 
deviceStorage.json file. The related specification implements points 3) and 4) above. 


Full documentation is available on the TCF v2 Github project. 


Implementation timeline 
Please note the following deadlines: 


e Vendors are required to update their GVL registration with the minimum required 
information by 30th September 2020. We will advise all vendors when the GVL 
registration has been updated with the required fields so vendors can make updates 
(est. 20th August). 

e Vendors are encouraged to include the optional deviceStorageDisclosureUrl field as 
this field might become mandatory in the near future. 


N.B.: consent will be considered invalid where this information is not disclosed, therefore 
vendors who do not provide the mandatory information by the deadline will be removed 
from the GVL until they have done so. 


e CMPs are required to implement the policy and specification by 31st January 2021. 
N.B.: Validator policy checks will be updated to reflect these amendments but CMP 


Framework Uls will not need to apply for re-validation. The requirements will, however, be 
taken into account for enforcement purposes as of the implementation deadline. 
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